What is the sense of 2 virtual VPN network interfaces or 2 VPN gateways?

A friend asked me today, what is the sense of 2 virtual VPN network interfaces or 2 VPN gateways.

Classic VPN connecting business locations 

In the classic way at golden millenium, companies wanted to connect their business locations with VPN, because internet access with a huge bandwidth became very cheap, because of liberalisation of internet and ISDN connections between different business locations still left expensive, when connections were 24/365 open.

Instead of avoiding all permanently broadcasting services, that are not fundamentally needed (like rwho), some of the companies bought a powertimer at low costs to avoid NT-Domain pings and other broadcasts.

In that time arround the golden millenium, VPN (virtual private network) became a more popular expression and since some companies invested in IPSec (FreeSwan) or PPTP GRE VPN technology,

many companies also wanted to have this.

Furthermore a backup internet connection became often cheaper as an ISDN backup over normal phone lines. Cable providers and XDSL providers had very special offers at the time.

All VPN traffic is routed through headquater location green

In that scenario, a headquater with (l-1) virtual vpn interfaces routes all traffic to all other location.

Classic central star network topolgy, where each not headquater location only need 1 vpn virtual network interface.

The advantage of that scenario is, that location green can make more complete rules at the firewall and vpn routing, which packages are to route.

Disadvantage of that scenario is, that IPX/SPX tunnels over ipsec/pptp tunnel over internet became very slow with huge package loss. 

All over cloud provider VPN gateway

Today companies often uses a VPN cloud gateway from a cloud provider to route their traffic between different locations. 
Advantage is, that the cloud provider might guarantee a 24/356 availibility and that huge cloud providers offer up to 32 backup gateways, if you need to route hurtig.

Disadvantage in that scenario is, that the cloud provider VPN gateway is same as the headquater in example before.

types in our economy

 Roughly speaking, there are the following types in our economy:

1. Producers / builders / manufacturers

Everyone part of a production process and anyone who produces something, that others want / demand, e.g. Journalists, car factory workers, software developer, hardware producers, clothing producers, farmers, house builders, ...

2. Service offerers / providers / suppliers

Everbody, who offers a service, that others need / demand, such as hair cuts, medical services in hospital, taxi drivers, teachers, coworkers at digital service industries, cinemas, public and private transport, security service from bodyguards, energy and water suppliers, ...

3. Traders

Everbody who trades (mostly products of producers, but also derivates, foreign currency swaps, free timeslots, ...)

Mixed types of 1. 2. 3. are usual

4. Members of  trusted institutional authorities:

People, who work as judge, authorities, who sign you a valid driving license (not a snake oil driving license), everybody who works at a trustful state, companies or workers association, foundation.

5. Artists

All people, that offer or produce something, that you might not always demand or need, but what's quiet nice to have, e.g. Philosopher, street artist, art film producer, bon vivant, entertainer and also sportsman

Just let's crypt

Famous and well known crypt libraries

https://bouncycastle.org/

https://www.gnutls.org/

https://git.lysator.liu.se/nettle/nettle

https://www.wolfssl.com/

https://www.cs.auckland.ac.nz/~pgut001/cryptlib/

https://gnupg.org/software/libgcrypt/

https://firefox-source-docs.mozilla.org/security/nss/index.html

https://nacl.cr.yp.to/box.html

NSA presents itself as a more official organization

https://code.nsa.gov/

https://ghidra-sre.org/

https://github.com/NationalSecurityAgency

https://github.com/orgs/NationalSecurityAgency/repositories

http://nationalsecurityagency.github.io/

cqrxs.eu will launch until 27nd march 2025

Implementiere bis 22.2.2025 eine cqrxs.eu Plattform, die einen Secure-Chat und sicheres einmaliges hinterlegen von Codes, Texten (kann auch IPv6 Endpoint 2 Endpoint / Peer2Peer ohne Server) beinhaltet.

Verschlüsselt wird mit einem 8-fachen AES mit folgenden Varianten des AES:
3DES, Blowfish, 2-Fish, 3-Fish, AES Golois fields, Camellia, Cast[56], Gost28147, Idea, RC[26], RC532, Seed, Serpent, Skipjack, Tea, Tnepres, XTea und einer eigenen sehrr schnellen, aber cryptographisch nicht so starken SymmCipher Variante "ZenMatrix".

https://area23-at.blogspot.com/2025/01/cqrxseu-will-launch-until-22nd-february.html

I will implement a cqrxs.eu platform until February 21st 2025,
that includes a secure chat (can also be IPv6 endpoint 2 endpoint / 

peer2peer without a server / or a chat over server proxy variant)
and secure one-time storage of codes and texts.

Encryption is done with an 8-fold AES with the following variants of AES:
3DES, Blowfish, 2-Fish, 3-Fish, AES Golois fields, Camellia, Cast[56], Gost28147, Idea, RC[26], RC532, Seed, Serpent, Skipjack, Tea, Tnepres, XTea and 

our own very fast, but cryptographically not so strong SymmCipher variant "ZenMatrix".

https://area23-at.blogspot.com/2024/04/making-symetric-chiffer-encryption.html

See prototype of WinForms chat client below,
that also can send / receive loopback.

CqrJd C# is a [MUST HAVE]

CqrJd Java is [OPTIONAL] <= started implementation & looks good
CqrJd in C/C++ is [OPTIONAL] <= there'll be at least a skeleton

IPv6 socket server in C under linux, C#, java

 

chat-ipv6

is same as a forking ipv6 server, but using clone(2) for posix threads instead of fork (copying entire process image).

currently only availible for linux / unix and gcc

build project

client6.s and server6_clone.s can be compiled and linked with GNU make utility by using existing Makefile.

change directory to source and Makefile containing directory server6-clone.

• cd server6-clone/

Now clean project to delete outdated binary executables or objects.

• make clean

  rm -f client6 client6.o server6_clone server6_clone.o
  

build client6

• make client6

  ggcc "-Wimplicit-function-declaration" -o client6.o -c  client6.c

  client6.c: In function ‘ping’:
  client6.c:42:27: warning: embedded ‘\0’ in format [-Wformat-contains-nul]
  42 |     sprintf(inbuf, "%s\r\n\0", msg); 
     |                           ^~
  client6.c:49:16: warning: function returns address of local variable [-Wreturn-local-addr]
  49 |         return &outbuf[0];
     |                ^~~~~~~~~~
  client6.c: In function ‘main’:
  client6.c:92:17: warning: implicit declaration of function ‘close’; did you mean ‘pclose’? [-Wimplicit-function-declaration]
  92 |                 close(sd);
     |                 ^~~~~
     |                 pclose
  gcc "-Wimplicit-function-declaration" -o client6 client6.o

build server6

• make server6_clone
  
  

  gcc  "-Wimplicit-function-declaration" -o server6.o -c server6.c
  gcc "-Wimplicit-function-declaration" -o server6 server6.o
  

start server at a custom tcpv6 port

• ./server6 "2600:1f18:7a3f:a700::6291" 7777
  

  ./server6 program started...
  server trys listening on address 2600:1f18:7a3f:a700::6291 port: 7777
  ./server6: cannot clone(2), trying to fork(2)./server6: offset: 1024,   pagesze_offet: 4095,    pa_offset: 0,
  sockets:        s_sd=3, c_sd=4
  ./server6: cannot clone(2), trying to fork(2)./server6: client request handled after sending/receiving 136 bytes total.
  ./server6       closed client socket descriptor 4 now, exiting in 1 secondchild pid: 231095child pid 231095 exited, status=0, done=1
  ^C
  zen@virginia:~/prog/chat-ipv6/c-server6$ sudo ./server6 "2600:1f18:7a3f:a700::6291" 7777
  ./server6 program started...
  server trys listening on address 2600:1f18:7a3f:a700::6291 port: 7777
  ./server6:      offset: 1024,   pagesze_offet: 4095,    pa_offset: 0,
  sockets:        s_sd=3, c_sd=4
  ./server6:      client request handled after sending/receiving 136 bytes total.
  child pid: 231102 child pid 231102 exited, status=0, done=1
  ./server6:      offset: 1024,   pagesze_offet: 4095,    pa_offset: 0,
  sockets:        s_sd=3, c_sd=5
  ./server6:      client request handled after sending/receiving 135 bytes total.
  child pid: 231107 child pid 231107 exited, status=0, done=1

java ipv4/ipv6 EchoServer & EchoClient

compile java sources with any javac compiler

Windows

• winmake

  winmake.bat
  > echo "building now EchoServer classes..."
  "building now EchoServer classes..."
  > javac EchoServer.java
  > echo "building now EchoClient class."
  "building now EchoClient class."
  > javac EchoClient.java
  > dir *.class
  Directory of C:\Users\heinr\source\chat-ipv6\java-server6
  10/12/2024  03:40             3.188 EchoClient.class
  10/12/2024  03:40             5.368 EchoServer.class
             2 File(s)          8.556 bytes

Linux

• make all

  zen@virginia:~/prog/chat-ipv6/java-server6$ make all
  rm -f *.class
  javac EchoServer.java
  javac EchoClient.java
  zen@virginia:~/prog/chat-ipv6/java-server6$ ls -al *.class
  -rw-r--r-- 1 zen mailers 3188 Dec 10 03:44 EchoClient.class
  -rw-r--r-- 1 zen mailers 5368 Dec 10 03:44 EchoServer.class
  zen@virginia:~/prog/chat-ipv6/java-server6$

starting java socket server with no args for both ipv4/6

• java EchoServer "172.31.20.156" "2a05:d012:209:ee00:a8ba:d6c4:bd60:bab5" 7777

zen@paris:~/prog/chat-ipv6/java-server6$ java EchoServer "172.31.20.156" "2a05:d012:209:ee00:a8ba:d6c4:bd60:bab5" 7777
server address set to 172.31.20.156
server address6 set to 2a05:d012:209:ee00:a8ba:d6c4:bd60:bab5
Simple TCP Echo Server started ...
Simple TCP Echo Server started ...
EchoServer is listening on address 2a05:d012:209:ee00:a8ba:d6c4:bd60:bab5 port 7777.
EchoServer is listening on address 172.31.20.156 port 7777.
Accepted connection to 2600:1f18:7a3f:a700:0:0:0:6291 (2600:1f18:7a3f:a700:0:0:0:6291) on port 58318.
Receiving from socket:
Finished, now sending back to socket:
2a05:d012:209:ee00:a8ba:d6c4:bd60:bab5 =>      2600:1f18:7a3f:a700:0:0:0:6291   uname -a : Linux ip-172-31-57-91 6.8.0-1019-aws #21-Ubuntu SMP Wed Nov  6 21:21:49 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
client socket close()
Accepted connection to ec2-100-26-162-115.compute-1.amazonaws.com (100.26.162.115) on port 48304.
Receiving from socket:
Finished, now sending back to socket:
172.31.20.156  =>      ec2-100-26-162-115.compute-1.amazonaws.com/100.26.162.115       uname -a : Linux ip-172-31-57-91 6.8.0-1019-aws #21-Ubuntu SMP Wed Nov  6 21:21:49 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
client socket close()

starting java echo client

• java EchoClient "2a05:d012:209:ee00:a8ba:d6c4:bd60:bab5" 7777 "uname -a : uname -a "

zen@virginia:~/prog/chat-ipv6/java-server6$ java EchoClient "2a05:d012:209:ee00:a8ba:d6c4:bd60:bab5"  7777 "uname -a : `uname -a` "
Receiving:
2a05:d012:209:ee00:a8ba:d6c4:bd60:bab5 =>      2600:1f18:7a3f:a700:0:0:0:6291   uname -a : Linux ip-172-31-57-91 6.8.0-1019-aws #21-Ubuntu SMP Wed Nov  6 21:21:49 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
finished
zen@virginia:~/prog/chat-ipv6/java-server6$ java EchoClient "13.38.136.165"  7777 "uname -a : `uname -a` "
Receiving:
172.31.20.156  =>      ec2-100-26-162-115.compute-1.amazonaws.com/100.26.162.115       uname -a : Linux ip-172-31-57-91 6.8.0-1019-aws #21-Ubuntu SMP Wed Nov  6 21:21:49 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
finished
^C

Россия - Russia some gone on x.com [ twitter ]

In August 2016 I wrote a small twitter to follow poem in German:
https://area23-at.blogspot.com/2016/08/twitter-follower-poem-deutsch.html

Later in January 2017 I blogged a list of geopolitically relevant accounts on twitter:
https://area23-at.blogspot.com/2017/01/twitter-who-2-follow-draft.html

---

Россия - Russia some gone on x.com [ twitter ]

Suspended:
twitter.com/PutinRF
twitter.com/PutinRF_Eng
twitter.com/DmitriTrenin

Account Withheld inside EU:
twitter.com/RT_com
twitter.com/SputnikInt

Inactive since 2020-2022:
x.com/NordStream2
x.com/KremlinRussia
x.com/KremlinRussia_E
x.com/GovernmentRF

Still Active now:
x.com/CarnegieRussia
x.com/MedvedevRussiaE
x.com/Russia
x.com/mfa_russia
x.com/GazpromEN

---

SPRD PGD Watch via Alibaba & 2FAS Authenticator App

Ich habe mir eine Android WearOS Smartwatch über AliBaba bestellt und aus China (2 Wochen warten) liefern lassen.
Kostete 48€ innerhalb China & HongKong, mit Zoll & EORI Nummer[1] alles korrekt verzollt für mich als Einzelunternehmer 70€-80€.

Alle Standard Android features funktionieren gut:
Telefon, SMS, WLAN, 4G Netz, Google Account,  Maps GPS.

Allerdings ist twillo authy inzwischen so sicher, dass man sich den 2-Step Authenticator nur auf ganz sicheren Geräten installieren kann. Das funktionierte bei meiner neuen sehr günstigen Smartwatch nicht, allerdings auch in keinem Android Emulator, wo ich es jetzt nochmal testete.
Die Kamera Auflösung ist etwas düftig und Bilder und Videos sind entsprechend unscharf.
Sehr viele Apps sind im Android AppStore play.google.com außerdem noch nicht auf WearOS, ich meine hier auf kleines Display und Usability (besser weniger DragNDrop und mehr touch bei sehr kleinen Displays) optimiert und portiert.

Manual zur Erstellung von WearOS Apps in Android Studio[2]:
Portieren auf WearOS ist relativ gut dokumentiert,
hier: https://developer.android.com/wear
und hier: https://developer.android.com/wear/gallery

Update:

Ich habe jetzt 2FAS Authenticator App auf WearOS Smartwatch & Nokia Smartphone installiert.

GitHub Repository gibt es hier: https://github.com/twofas

Ist über Google Drive (Password geschützt) mit Google Account synchronisierbar auf allen Geräten, wo ich angemeldet bin.
Weiters können alle Tokens auch in eine Datei im Spezialformat (ebenfalls Password geschützt empfoholen) exportiert oder von der Spezialdatei in den 2FAS Authenticator importiert werden.

Welchen 2 Faktor Authenticator App verwendet ihr?